Chris Trudesk input validation error vulnerability

Versions 1.2.11 and earlier of Chris Trudesk contain an input validation error vulnerability. This vulnerability stems from server-side JavaScript injection in the search parameter; authenticated users can inject code into MongoDB’s $where clause. By disabling regular expressions in GET...

vLLM processing logic error vulnerability

Versions of vLLM prior to 0.31.0 contain a logic error vulnerability. This vulnerability stems from a cross-request mask leakage in InputBatch.condense, where an outdated line of allowedtokenids remains. Attackers can submit concurrent requests via unauthenticated /invocations, causing the recycl...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the Redis reply parser fails to limit recursion depth; as a result, remote peers on the Redis server return deeply nested RESP array replies, potentially causing the bRPC...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the HTTP/2 HPACK decoder fails to limit recursion depth. Remote attackers can exploit this by sending specially crafted HTTP/2 header blocks containing numerous consecutive...

Electron buffer error vulnerability

Versions of Electron prior to 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9 contain a buffer error vulnerability. This vulnerability arises from the main process failing to properly verify the webContents.beginFrameSubscription frame data received from the GPU process. An attacker who gains code...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the mcpack2pb component parser fails to verify the count of elements within the mcpack array header based on the actual size of the payload. Remote attackers can exploit th...

Pypdf input validation error vulnerability

Versions of pypdf prior to 6.21.1 contain an input validation error vulnerability. This vulnerability allows attackers to craft PDF files containing image data with /DCTDecode filter tags; upon loading these images, Pillow selects and invokes an unintended image parser...

Michelle Tilley TOML Parser for Node.js input validation error vulnerability

Versions prior to 5.0.1 of the Michelle Tilley TOML Parser for Node.js contain an input validation error vulnerability. This vulnerability arises because quoteDottedString in lib/compiler.js generates identical bookkeeping strings for different quote key paths, allowing addTableArray to bypass...

Vulnerability related to improper handling of Apache bRPC

Versions of Apache bRPC prior to 1.18.0 contain a logic error vulnerability stemming from an interpretation conflict in the HTTP protocol implementation. The method dispatch function FindMethodPropertyByURI utilizes a string splitter that skips empty fields to segment request paths; this causes...

Apache Traffic Server input validation error vulnerability

A input validation error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability stems from improper handling when Content-Length or Transfer-Encoding is included in HEAD requests, potentially leading...

Apache Traffic Server resource management error vulnerability

Versions 10.0.0 through 10.1.4 and 10.2.0 of Apache Traffic Server contain a resource management error vulnerability. This vulnerability stems from post-free reuse in the transaction close handler within an experimental WASM plugin, which forwards unvalidated metric IDs provided by guests to an...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.1 contain a buffer error vulnerability. This vulnerability arises because clientclipresentgatewaymessage passes the byte count as the precision for printf on wide characters. A malicious RD Gateway can send pre-authenticated consent or service messages, causing t...

Electron buffer error vulnerability

Versions of Electron prior to 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9 contain a buffer error vulnerability. This vulnerability arises from the main process failing to fully verify the macOS off-screen rendering frame data from the GPU process. This can allow attackers who have obtained code...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.1 have a buffer error vulnerability. This vulnerability arises from the Android client not verifying the mappedWidth and mappedHeight values. An attacker can send a specially crafted RDP GFXMAPSURFACETOWINDOWPDU with an excessively large size, causing...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.1 have a buffer error vulnerability. This vulnerability stems from the DVIADPCM block-aligning arithmetic operations in the rdpnsndserverselectformat function of the server’s rdpnsnd channel. Integer round-off occurs, and validations are bypassed. A malicious RDP...

Apache Traffic Server resource management error vulnerability

A resource management error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability arises from exhausting the worker pool of HTTP/1.1 sources by truncating the HTTP/2 Content-Length value, potentiall...

Apache Traffic Server input validation error vulnerability

A input validation error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability arises when a client sends a POST request containing Expect: 100-continue, and the source server responds before readin...

NTPsec buffer error vulnerability

Versions NTPsec 1.1.4 through 1.2.5 contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds read during the parsing of NTS extension fields. Remote attackers can exploit this by providing an NTS Authenticator and Encrypted Extension Fields AEEF field with an excessive...

Pillow resource management error vulnerability

Versions of Pillow from 5.1.0 up to but not including 13.0.0 contain a resource management error vulnerability. This vulnerability arises because PdfParser.linearizepagetree in src/PIL/PdfParser.py fails to track repeated indirect references. When processing malicious PDFs that reference the same...

Apache Traffic Server resource management error vulnerability

Versions 8.1.11, 9.2.5 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 of Apache Traffic Server contain a resource management error vulnerability. This vulnerability arises when proxy.config.http.dropchunkedtrailers is enabled; the service then waits for the dropped trailing bytes, causing...